В Пнд, 26/04/2010 в 16:51 +0200, Roman Fiedler пишет: > Hello list, > > Besides connection limits, shouldn't it be possible to place the various > subnet rules in a sort of balanced/optimized tree to decrease the access > time? Are there tools available for that, that use e.g. the DROP log > entries from an unbalanced list to optimize the tree (like > huffman-encoding for data streams)? Can ipset do that? http://ipset.netfilter.org/features.html I'm not familiar with huffman-encoding, but it seems ipset can store IPs in hashes and trees (with timeout), but NETs are only possible in hash. Not to say that there is an automatic tool for that, but you can make any kind of tree with just iptables' user defined CHAINs. It could probably be slow on insert/delete but definitelly fast on lookup. If the performance is the point and hight number of rules is the need one can also look at hipac, didn't tried it myself. -- Покотиленко Костик <casper@xxxxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
